cakephp: [2.7] New CakeResponse sent, ignoring attached DispatcherFilters on thrown exception

I’m working on an API that needs CORS headers to be sent for all responses, in order for the browser to not throw errors such as:

XMLHttpRequest cannot load http://example.org/api/purchases.json. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8100' is therefore not allowed access. The response had HTTP status code 401.

The above error happens when the auth token expired/was invalidated and I throw UnauthorizedException.

Here you can see that a new CakeReponse is always created when outputting error responses: https://github.com/cakephp/cakephp/blob/2.7/lib/Cake/Error/ExceptionRenderer.php#L146

I’m not sure we can access the original CakeResponse instance in any way, but maybe we can still attempt to run DispatcherFilters?

Looking at the code in 3.x, it seems it suffers from the same fate, always sending a vanilla CakeResponse.